White Paper · Employment · AI Hiring

AI in Hiring in Illinois: IHRA, Video Interviews, BIPA, and the Evidence Behind the Decision

Illinois employers need more than a vendor assurance that a hiring product is “compliant.” The analysis follows the function: whether AI influences an employment decision, whether a recorded video interview is analyzed, whether biometric identifiers or information are collected, and whether the process can be explained and accommodated.

By Lincoln Square Law · 13-minute read

Start with the decision, not the vendor label

An employer cannot determine its Illinois obligations by asking whether a vendor calls its product “AI.” Start with what the system does in the employment workflow. Does it source candidates, rank resumes, score assessments, analyze interviews, recommend interview selection, screen for promotion, measure productivity, recommend discipline, or influence termination? Illinois Human Rights Act section 2-102(L) is deliberately broader than recruiting software: it reaches AI used with recruitment, hiring, promotion, renewal of employment, training or apprenticeship selection, discharge, discipline, tenure, and terms, privileges, or conditions of employment.

That statute creates two distinct control questions. First, does the AI have the effect of subjecting employees to discrimination based on protected classes, or use ZIP codes as a proxy for protected classes? Second, has the employer provided the required notice when it uses AI for the covered purposes? The statute directs the Illinois Department of Human Rights to adopt implementing rules, including rules concerning notice. Employers therefore need a process that can absorb rulemaking changes without rebuilding the entire hiring stack.

Layer one: the Illinois Human Rights Act

The Human Rights Act is the broadest layer because it follows employment decisions. A resume screener that never sees a face or fingerprint can still matter. A productivity model used for promotion can matter. A scheduling or attendance score that feeds discipline can matter. Treat “human in the loop” as a control to evaluate, not an automatic exemption: if a system materially shapes the information, ranking, or recommendation on which a person acts, the organization should understand and document that influence.

Build a decision register for every covered use. Record the job stage, output, features used, data sources, protected-class testing approach, proxy review, threshold settings, override authority, accommodation process, notice status, and business owner. Then preserve evidence of periodic review. The legal risk is not limited to intentionally discriminatory code, because the Illinois provision speaks in terms of discriminatory effect.

Layer two: the Artificial Intelligence Video Interview Act

The Artificial Intelligence Video Interview Act has a narrower trigger. When an employer asks an applicant to record a video interview and uses AI analysis of that applicant-submitted video for a position based in Illinois, the employer must act before the interview: notify the applicant that AI may be used to analyze the video and consider fitness for the position, explain how the AI works and the general types of characteristics it uses to evaluate applicants, and obtain consent. The employer may not use the AI evaluation on an applicant who has not consented.

The Act also controls the video after collection. Sharing is limited to people whose expertise or technology is necessary to evaluate fitness. On an applicant’s request, the employer must delete the interview within 30 days and instruct others who received copies to delete them, including electronically generated backup copies. If the employer relies solely on AI analysis of a video interview to decide who is selected for an in-person interview, demographic reporting duties apply.

These obligations need contract support because the employer cannot satisfy deletion or sharing restrictions if the vendor cannot identify recipients or propagate a deletion request.

Layer three: BIPA when biometrics are actually in the flow

BIPA is not automatically triggered merely because a system analyzes video. The statute defines specific biometric identifiers, such as fingerprints, voiceprints, and scans of hand or face geometry, and biometric information based on covered identifiers used to identify an individual. The legal review therefore needs a factual answer from the vendor: what signals are captured, what derived templates or features are created, whether those features are used to identify a person, where they are stored, and who receives them.

When BIPA applies, section 15 requires four controls that should exist before collection. The first is a public retention and destruction policy. The second is written notice that a biometric identifier or biometric information is being collected or stored. The third is written notice of the specific purpose and the length of time it will be collected, stored, and used. The fourth is a written release. The Act also restricts selling or otherwise profiting from biometric data, limits disclosure, and requires reasonable care in storage and transmission. The 2024 amendment recognizes electronic signatures and limits repeated same-method collection or same-recipient disclosures to one violation for recovery purposes, but it did not erase the private right of action or the underlying duties.

Do not let three notices become three contradictory stories

A common implementation failure is drafting each notice in isolation. The career-site privacy notice says one thing, the video-interview consent says another, the BIPA release uses a third retention period, and the vendor’s interface describes different data. Reconcile the notices against one verified data-flow diagram. The applicant should not be told that a tool evaluates “communication style” if the vendor documentation shows facial geometry, voice features, or inferred traits that the employer has never assessed.

Likewise, do not promise that data is deleted immediately if backups persist or if reporting obligations require retention.

Legal, HR, privacy, security, and procurement should approve one source-of-truth description and then derive the required notices from it.

Contract for the evidence you will need

Vendor diligence should require a technical description of model inputs and outputs, training and evaluation materials appropriate to the use, data-location and subprocessor details, retention and deletion mechanics, security controls, incident notice, change notification, and cooperation with discrimination or accommodation investigations. The contract should prevent the vendor from materially changing the model, feature set, or data use without notice when those changes could alter the legal analysis.

For video interviews, require support for the statutory sharing and deletion restrictions. For potential biometrics, require the vendor to state whether it creates or receives covered identifiers or information and to support the organization’s retention and destruction schedule. For employment decisions, preserve enough data to investigate a challenged outcome without retaining information indefinitely.

Add disability and accommodation controls

Federal disability law remains relevant even when the Illinois stack receives most of the attention. The EEOC has warned that algorithmic tools can screen out applicants or employees with disabilities and that employers may need reasonable accommodations or alternative testing formats. The practical control is an accessible accommodation channel that applicants can use before the tool produces an adverse result, together with instructions for recruiters and hiring managers about when to pause the automated workflow.

The employer should also test whether a feature is measuring job-related ability or merely measuring interaction with the technology. A timed assessment, speech analysis, gaze-related feature, or keyboard metric can disadvantage people for reasons unrelated to essential job functions. No state-specific notice fixes a badly designed decision process.

Use one pre-deployment gate for all three layers

Before a hiring AI system goes live in Illinois, require a documented approval gate. Map the employment decision and determine whether section 2-102(L) applies. Determine whether AI analysis of recorded video is involved and whether BIPA-covered data is collected. Verify notices, consent, deletion, and retention. Review discrimination and proxy risks, establish accommodation paths, approve the vendor contract, and assign someone to monitor the system. Re-run the gate after material product changes.

This turns three overlapping statutes into one operating process. The objective is not to classify the tool once and forget it. It is to know which legal layer applies to each use case and to preserve evidence that the employer understood the technology before allowing it to influence people’s jobs.

Preserve an adverse-decision investigation package

When a candidate or employee challenges an AI-influenced outcome, the employer should be able to reconstruct the decision without reverse-engineering the system months later. Preserve the model or feature version, inputs used for the individual, output shown to the reviewer, decision criteria, human reviewer, overrides, accommodation requests, notices and consents, and any contemporaneous quality or bias monitoring. If vendor logs are necessary to reconstruct the event, the contract should specify how long those logs remain available and how they can be produced.

This record also helps separate legal questions. A discrimination inquiry may focus on effects across groups. A BIPA inquiry may focus on what biometric data was collected and disclosed. A Video Interview Act issue may focus on notice, consent, sharing, or deletion. One evidence package should support all three without forcing the employer to retain data indefinitely. Set a documented retention rule that reconciles investigation needs with statutory deletion and privacy obligations.

Map the full hiring funnel before classifying the tool

AI may enter recruiting through sourcing, résumé parsing, ranking, assessments, chatbots, interview scheduling, recorded video analysis, background workflows, or manager decision support. Build a funnel map showing where each system influences the candidate and what output reaches the next decision-maker. A product can affect hiring even if it never issues a final “hire” recommendation. Illinois Human Rights Act section 2-102(L) reaches the use of artificial intelligence with respect to recruitment, hiring, promotion, renewal, training, discharge, discipline, tenure, and terms or conditions of employment when the statutory conditions are met.

The same vendor can support several use cases with different legal triggers. Do not classify the product once at the enterprise level. Classify each use case: sourcing, screening, video analysis, scoring, scheduling, employee monitoring, promotion, or discipline.

Build notice and consent from one technical description

HR, legal, procurement, and the vendor should agree on a single technical description of what the tool analyzes and how the output is used. Derive required notices and consents from that description. For recorded video interviews analyzed by AI, the Artificial Intelligence Video Interview Act requires advance notice, information explaining how the AI works and the general types of characteristics used, and consent before evaluation. The Act separately limits sharing and requires deletion within 30 days after an applicant request, including instructions to other recipients to delete copies.

If the same process creates or receives covered biometric identifiers or biometric information, BIPA adds a different notice-and-release structure plus public retention, disclosure, and security duties. The organization should avoid three documents that describe the same system inconsistently. Maintain one approved fact sheet and map each statutory disclosure to it.

Test the decision process, not just the model

A vendor’s validation report can be useful, but the employer remains responsible for the way the tool is configured and used in its own process. Test thresholds, ranking rules, human override practices, recruiter instructions, and downstream use. Compare outcomes across relevant groups where legally and technically appropriate, investigate material disparities, and document what the organization did with the result. EEOC materials emphasize that federal discrimination laws apply when automated systems are used to make or inform employment decisions.

Testing should also look for proxy features and context changes. A model trained for one job family may behave differently when reused for another. A score intended as one input can become a de facto cutoff if managers treat it as dispositive. Governance should therefore cover human behavior around the tool as well as the model itself.

Create a real accommodation path

Applicants should have a practical way to request an accommodation or alternative process when disability affects interaction with an automated assessment. The responsible team must know who receives the request, how the candidate is moved to an alternative workflow, what information is shared with the hiring manager, and how the organization prevents the accommodation request itself from becoming a negative signal. EEOC guidance recognizes that algorithmic tools can screen out individuals with disabilities and that reasonable accommodation may require an alternative testing format or process.

Test the accommodation process before launch. A policy that says “contact HR” is not enough if the recruiting platform cannot bypass the assessment or if recruiters do not know how to preserve the candidate’s place in the process.

Preserve enough evidence to investigate an adverse decision

For consequential hiring stages, preserve the job requisition, version of the selection criteria, relevant tool version or configuration, candidate input or record as lawfully retained, score or recommendation, human reviewer action, override, notice and consent record, accommodation handling, and vendor evidence needed to interpret the output. This is not a directive to keep applicant data indefinitely. It is a records-design problem: define a lawful retention period that preserves necessary evidence without retaining sensitive data by default.

When a challenge occurs, freeze the relevant evidence and reconstruct the sequence before changing settings. The organization should be able to explain which system influenced the decision, which legal notices applied, what the human reviewer did, and whether the same process was used consistently.

Use renewal as a mandatory re-review point

Hiring technology changes quickly. Contract renewal should trigger a legal and technical re-review of model changes, new features, new data uses, subprocessors, retention, and the employer’s actual workflow. Compare the current system to the version originally approved. If the vendor has added video analysis, voice features, face geometry, automated ranking, or employee monitoring, update the inventory and legal classification before renewing or enabling the feature.